IoT Security: A Complete Guide to Securing Connected Devices

The number of connected devices on enterprise networks is growing faster than most security teams can track. With IoT Analytics reporting 21.1 billion connected IoT devices globally in 2025 — and projections exceeding 25 billion by 2026 — the attack surface is expanding at a pace that traditional endpoint security was never designed to handle. Most of these devices cannot run security agents. They ship with default credentials, receive infrequent firmware updates, and operate on proprietary systems that resist modification. The result is an environment where attackers find easy entry points and defenders struggle for visibility. This guide covers what IoT security is, the threats that matter most in 2026, recent breaches that expose real-world consequences, and the layered practices that organizations need to protect connected devices across the modern network.

What is IoT security?

IoT security is the practice of protecting Internet of Things (IoT) devices, the networks they communicate over, and the data they generate from cyber threats. It combines device security, network monitoring, identity and access controls, encryption, and continuous threat detection to secure connected devices such as sensors, cameras, medical equipment, industrial controllers, and smart building systems.

Because many IoT devices cannot run traditional endpoint security software, organizations increasingly rely on network-based visibility and behavioral analytics to detect compromised devices, prevent lateral movement, and reduce cyber risk across enterprise, industrial, and critical infrastructure environments.

The scale of the challenge continues to grow. According to IoT Analytics, connected IoT devices reached 21.1 billion globally in 2025, growing 14% year over year. The IoT security market reflects this urgency, with estimates ranging from $8 billion to $45 billion in 2026, depending on how IoT security is defined (source: comparecheapssl aggregation, 2026).

IoT security rests on three pillars: device security, network security, and cloud/data security. Each layer addresses a different segment of the attack surface, but the network layer carries outsized importance because it is the only layer that provides visibility into devices that cannot host their own defenses.

What is enterprise IoT security?

Enterprise IoT security focuses on protecting connected business devices such as IP cameras, printers, badge readers, HVAC systems, smart building controls, manufacturing sensors, medical devices, and industrial controllers. Unlike laptops or servers, many of these devices cannot support endpoint security agents, making network-based visibility and behavioral detection essential for identifying compromised devices before attackers can move laterally through the environment.

Why are IoT devices vulnerable?

IoT devices present a uniquely difficult security challenge for five reasons:

• Resource constraints prevent running full security stacks. Limited CPU, memory, and storage mean these devices cannot support the agents that protect laptops and servers.
• Default and hardcoded credentials remain the top vulnerability. The OWASP IoT Top 10 ranks weak, guessable, or hardcoded passwords as the number-one IoT risk, and roughly 20% of IoT devices still ship with default credentials in 2025.
• Infrequent firmware updates leave known vulnerabilities unpatched for months or years, with no secure update mechanism on many devices.
• Long device lifecycles extend far beyond planned end-of-support security, leaving legacy devices permanently exposed.
• Heterogeneous ecosystems with thousands of manufacturers, protocols, and operating systems make standardized security nearly impossible.

These vulnerabilities explain why botnet operators and nation-state actors increasingly target IoT devices as their initial foothold into enterprise networks.

Why vulnerability management alone doesn't secure IoT?

Traditional vulnerability management assumes that organizations can continuously patch systems, install endpoint agents, and remove vulnerable software. IoT environments rarely fit that model.

Many connected devices operate for a decade or more, rely on vendor-controlled firmware, or support only limited maintenance windows. In healthcare, manufacturing, and building management, taking a device offline to apply updates may interrupt critical operations. Even when vulnerabilities are known, remediation is often impractical.

As a result, organizations increasingly focus on reducing exposure rather than eliminating every vulnerability. Network segmentation, behavioral monitoring, and continuous detection help contain risk when devices cannot be patched immediately, shifting IoT security from a patch-first strategy to a visibility-first strategy.

How IoT security works

IoT security operates across three architectural layers, each addressing a different portion of the attack surface. Understanding how these layers interact — and where the gaps remain — is essential for building a defensible IoT environment.

Device layer. Security begins at the device itself through hardened firmware, secure boot processes, credential management, and encryption of data at rest. Manufacturers who follow standards like NIST SP 800-213 build security into devices from the design phase. However, many IoT devices ship without these protections, and organizations cannot retrofit them after deployment.

Network layer. Network segmentation (VLANs, microsegmentation) isolates IoT devices so that a compromise in one segment cannot spread freely. Traffic monitoring and anomaly detection via network detection and response solutions identify suspicious behavior in real time. This layer is the primary control for agentless environments.

Cloud and application layer. API security, access control, and data encryption in transit (TLS 1.2 or higher) protect the cloud services that IoT devices communicate with. Cloud security posture management ensures that misconfigurations — like the one behind the Mars Hydro breach — do not expose billions of records.

Alt text for architecture diagram: Three-layer IoT security architecture showing device hardening at the bottom, network monitoring via NDR in the middle, and cloud access controls at the top, with labeled detection points at each layer.

The role of network-based detection

Since the majority of IoT devices cannot run endpoint agents, network traffic analysis becomes the primary method for identifying compromised devices. According to industry research, 80% of IoT breaches start at the device level (2025, deepstrike.io), yet defenders must detect these compromises from the network — the only vantage point available.

Network detection and response monitors both east-west (internal) and north-south (external) IoT traffic flows to detect anomalous behavior: command and control callbacks, lateral movement, and data exfiltration attempts. Behavioral analytics baseline each device's normal communication patterns — an IP camera should communicate with its NVR, not with an external IP in an unfamiliar geography — and flag deviations automatically.

This agentless approach provides equal visibility into managed and unmanaged devices, closing the gap that endpoint-only strategies leave wide open.

See network visibility across OT and IT environments: See how Vectra AI provides network-based visibility across OT and IT environments to help security teams identify suspicious behaviors and potential threats.

IoT security architecture

Building a resilient IoT security architecture requires four capabilities working together:

1. Device inventory and discovery. You cannot secure what you cannot see. Automated discovery tools must identify every connected device, its manufacturer, firmware version, and network location.
2. Network segmentation. Isolating IoT devices into dedicated segments reduces the blast radius of a compromise and prevents lateral movement into critical IT systems.
3. Continuous monitoring. Behavioral analytics detect when a device deviates from its expected communication pattern, catching threats that signature-based tools miss.
4. Incident response integration. Automated containment of compromised IoT devices — such as quarantining a device at the network switch — stops attacks before they escalate.

How AI improves IoT security

Modern IoT environments generate enormous volumes of network telemetry that are impossible to analyze manually. AI helps security teams identify compromised devices by learning how each device normally communicates and detecting deviations that indicate malicious activity.

For example, AI can identify:

• Cameras communicating with unfamiliar external servers

• Medical devices initiating unexpected outbound connections

• Sensors performing internal network scans

• Command-and-control communications

• Lateral movement between network segments

• Data exfiltration attempts

Because most IoT devices cannot host endpoint security software, AI-powered behavioral analytics operating at the network layer have become one of the most effective approaches for detecting attacks across unmanaged devices.

Top IoT security threats and risks

IoT threats in 2026 range from 20+ Tbps botnets and supply chain malware to AI-powered reconnaissance and state-sponsored campaigns targeting critical infrastructure. The table below maps the most prevalent threats to MITRE ATT&CK techniques observed in IoT attacks.

Table: MITRE ATT&CK techniques most commonly observed in IoT attacks (2024—2026)

Botnet recruitment and DDoS. The Aisuru/TurboMirai botnet achieved 20+ Tbps DDoS capability in 2025—2026, representing a 700% year-over-year growth in attack potential. Microsoft Azure blocked a record 15.72 Tbps DDoS attack linked to IoT botnets in early 2026.

Supply chain compromise. BadBox 2.0 compromised more than 10 million smart TVs, projectors, and infotainment systems with pre-installed malware in 2025, making it the largest known TV botnet (source: Asimily).

Ransomware targeting OT and IoT. Ransomware attacks against OT systems surged 46% in 2025, according to Nozomi Networks, increasingly using compromised IoT devices as the initial entry point.

Data exposure. The Mars Hydro misconfiguration exposed 2.7 billion IoT device records in 2025, demonstrating that cloud-side IoT security failures can be just as devastating as device-level compromises.

Emerging threat vectors (2025—2026)

• AI-powered attacks. The Aisuru botnet uses AI for automated reconnaissance and "precision flooding," adapting its DDoS patterns to evade mitigation in real time.
• State-sponsored IoT campaigns. IOCONTROL, attributed to an Iranian APT, targeted critical infrastructure IoT and OT systems in the United States and Israel throughout 2025.
• Next-generation Mirai variants. ShadowV2, Eleven11bot (86,000+ compromised devices), PumaBot (SSH brute-forcing), and Kimwolf (2+ million devices) represent the continuing evolution of IoT botnet malware.
• 5G expanding the attack surface. As more IoT devices gain high-bandwidth 5G connectivity, the volume and speed of potential attacks increase proportionally.

Across all categories, Bitdefender and Netgear detected 13.6 billion IoT attacks between January and October 2025 alone.

IoT security in practice: recent breaches (2024—2026)

Recent IoT breaches demonstrate that supply chain attacks, botnets, and misconfigurations pose existential risk to unprepared organizations. The five cases below — all from 2024-2026 — illustrate the scale and variety of real-world IoT security failures.

1. BadBox 2.0 (July 2025). Pre-installed malware compromised more than 10 million smart TVs, projectors, and infotainment systems, creating the largest known TV botnet. Lesson: Verify firmware integrity and supply chain provenance before deploying any connected device. (Source: Asimily)
2. Mars Hydro (2025). A cloud misconfiguration exposed 2.7 billion IoT device records, including Wi-Fi credentials and device identifiers. Lesson: IoT data requires the same cloud security posture management as traditional IT data. (Source: Asimily)
3. Aisuru/TurboMirai (2025—2026). This botnet achieved 20+ Tbps DDoS capability with 700% year-over-year growth, prompting Azure to block a record 15.72 Tbps attack. Lesson: Network-based traffic analysis is essential for detecting compromised devices participating in botnet activity. (Source: SecurityWeek, CSO Online)
4. Raptor Train (September 2024). A state-sponsored botnet compromised more than 200,000 SOHO and IoT devices since 2020, using a sophisticated three-tiered command architecture. Lesson: Maintain comprehensive device inventories and implement network segmentation to detect and contain long-running campaigns. (Source: Asimily)
5. Roku credential stuffing (March—April 2024). Two successive attacks affected 591,000 accounts. Roku responded by enabling mandatory multi-factor authentication for all 80 million users. Lesson: Mandatory MFA and credential monitoring are essential for IoT platforms with user accounts. (Source: Asimily)

Business impact of IoT breaches

The financial consequences of IoT cyberattacks are substantial and growing:

• The average IoT security incident costs $330,000 per event (2025—2026, comparecheapssl).
• Healthcare cybersecurity incidents involving IoMT devices exceed $10 million on average (2025—2026). One in five medical devices runs an unsupported operating system, and 77% of hospital systems contain known exploited vulnerabilities.
• The retail sector lost more than $20 billion to IoT cyberattacks in 2024 (comparecheapssl).
• Industrial IoT attacks increased 75% over the past two years (comparecheapssl, 2025).
• IoT devices face approximately 820,000 attacks daily worldwide (2025—2026, comparecheapssl).
• Connected homes faced an average of 29 daily attack attempts in 2025 — a threefold increase from 2024 (Bitdefender/Netgear).

These figures underscore why IoT security is no longer optional. A single data breach from an unmonitored IoT device can cost more than years of preventive investment.

IoT security vs OT security

IoT and OT security share overlapping challenges but differ in priorities, device characteristics, and detection methods. Understanding these differences — and where the domains converge — is essential as organizations manage increasingly interconnected environments.

Table: Key differences between IoT, OT, and IIoT security

Industrial IoT (IIoT) bridges both worlds, deploying connected sensors and controllers in manufacturing and critical infrastructure settings where both data integrity and physical safety are at stake.

A landmark regulatory development arrived on December 11, 2025, when CISA released CPG 2.0, unifying IT, IoT, and OT security goals under six functions: Govern, Identify, Protect, Detect, Respond, and Recover. This is the first framework to formally bridge all three domains, reflecting the convergence that security teams have been managing operationally for years.

Organizations need integrated threat detection and compliance capabilities that span IoT, OT, and IT — not siloed tools that create blind spots at the boundaries.

Detecting and preventing IoT threats

Effective IoT defense requires eight layered practices, from device inventory through zero trust, with network-based monitoring bridging the agentless security gap.

1. Maintain a complete device inventory — track every IoT device with its manufacturer, model, firmware version, and network location (NIST SP 800-213, CISA CPG 2.0).
2. Implement network segmentation — isolate IoT devices in dedicated VLANs or microsegments to contain compromises.
3. Change default credentials immediately — the OWASP IoT Top 10 ranks this as the number-one risk, and 20% of devices still ship with defaults (2025).
4. Deploy network-based monitoring — NDR and behavioral analytics detect threats on devices that cannot run agents.
5. Automate firmware updates — 60% of IoT breaches trace back to unpatched firmware (2025, deepstrike.io).
6. Encrypt all data in transit — enforce TLS 1.2 or higher and DTLS for constrained devices.
7. Apply zero trust principles — verify every device and connection; trust nothing by default.
8. Plan for device lifecycle management — address security from procurement through decommissioning.

Organizations should also integrate intrusion detection and prevention systems and vulnerability management programs into their IoT security strategy to ensure continuous posture assessment.

Zero trust for IoT environments

Adapting zero trust principles for IoT requires addressing a fundamental tension: many IoT devices cannot support standard zero trust components like multi-factor authentication or client certificates.

Practical solutions include:

• Network-enforced policies. Rather than relying on the device to authenticate, enforce segmentation and access control at the network layer.
• Device behavioral profiling. Establish each device's expected communication pattern and treat any deviation as a potential compromise.
• Automated quarantine. When behavioral analytics flag a device, automatically isolate it at the switch or firewall level to prevent lateral movement.
• Least-privilege access. Restrict each device to communicating only with the specific services it requires — nothing more.

The Cloud Security Alliance's Zero Trust Guidance for IoT provides a reference framework for organizations working through this adaptation.

IoT security compliance and frameworks

The IoT regulatory landscape is tightening rapidly, with EU CRA reporting obligations arriving in September 2026 and CISA CPG 2.0 already unifying IT, IoT, and OT security goals.

Table: IoT security regulatory landscape as of early 2026

Organizations selling connected products in the EU should begin preparing now. The CRA reporting obligations that take effect September 2026 require manufacturers to report actively exploited vulnerabilities within 24 hours — a significant operational commitment.

Modern approaches to IoT security

AI-driven network detection, market consolidation, and IT/IoT/OT signal correlation define the future of IoT security for modern enterprises.

AI-powered threat detection is reshaping how organizations protect IoT environments. Machine learning models trained on IoT traffic patterns can identify compromised devices faster than rule-based systems, and generative AI is beginning to automate intrusion response pipelines. By 2026, effective threat detection must ingest data from OT, IoT, and edge domains and correlate it with IT signals for unified visibility.

Market consolidation reflects the strategic importance of IoT security. ServiceNow's $7.75 billion acquisition of Armis in 2025 was the headline deal in a year when cybersecurity M&A exceeded $84 billion overall. Mitsubishi Electric's acquisition of Nozomi Networks (~$883 million) further signals that OT/IoT security has become a boardroom priority.

The network-centric approach is gaining traction as the primary IoT security control. Organizations are investing in behavioral threat detection and threat hunting capabilities that work across managed and unmanaged device populations, treating the network as the universal sensor.

How Vectra AI thinks about IoT security

Vectra AI approaches IoT security through the lens of network-based detection and Attack Signal Intelligence. Because IoT devices cannot run endpoint agents, the network becomes the primary source of truth for identifying compromised devices. Vectra AI's philosophy of assuming compromise — that smart attackers will get in, and finding them quickly is what matters — applies directly to IoT environments, where the expanding attack surface of unmanaged devices demands unified visibility.

This means correlating signals across on-premises, cloud, identity, and IoT/OT environments to surface real attacks, not more alerts. When a camera starts communicating with an unfamiliar external host or a sensor begins scanning internal subnets, network detection and response identifies the behavior and prioritizes it for investigation — regardless of whether that device can run an agent.

Future trends and emerging considerations

The IoT security landscape will continue to shift significantly over the next 12—24 months, driven by regulatory deadlines, evolving attack techniques, and technology convergence.

Regulatory enforcement begins in earnest. The EU Cyber Resilience Act's reporting obligations take effect September 11, 2026, requiring manufacturers to report actively exploited vulnerabilities in connected products within 24 hours. Organizations that sell or deploy IoT devices in the EU should audit their vulnerability disclosure processes now. In the United States, the future of the FCC Cyber Trust Mark program remains uncertain after UL Solutions withdrew as administrator in December 2025, but bipartisan congressional support suggests a replacement will emerge.

AI arms race accelerates. Attackers are using AI for automated vulnerability scanning, adaptive DDoS patterns, and evasion techniques that morph in real time. Defenders are responding with AI-driven behavioral analytics that can baseline millions of IoT devices and detect anomalies at machine speed. The advantage will go to organizations that deploy AI defensively before attackers scale their AI offensively.

IT/IoT/OT convergence becomes operational reality. CISA CPG 2.0 formalized what security teams have known for years: IT, IoT, and OT cannot be secured in isolation. Over the next 12 months, expect to see unified security platforms that correlate signals across all three domains, replacing the fragmented toolsets that create blind spots at domain boundaries. Organizations should prioritize investments in platforms that deliver cross-domain visibility.

Device volumes continue to climb. With IoT device counts projected to surpass 25 billion in 2026, the sheer volume of unmanaged endpoints will overwhelm organizations that rely on manual inventory and one-device-at-a-time security. Automated discovery, classification, and behavioral monitoring will shift from best practice to baseline requirement.

Conclusion

IoT security is no longer a niche concern — it is a core enterprise requirement. With 21.1 billion connected devices in 2025, threats escalating from 20+ Tbps botnets to supply chain malware affecting millions of devices, and regulatory deadlines approaching, organizations that defer IoT security investment are accepting risk they may not be able to absorb.

The path forward is clear. Build a complete device inventory. Segment IoT devices from critical systems. Deploy network-based detection to cover the devices that cannot protect themselves. Prepare for the EU CRA and CISA CPG 2.0 requirements that are already on the calendar. And adopt a mindset that assumes compromise — because in an environment with hundreds of thousands of unmanaged devices, finding the attacker quickly matters more than hoping they never get in.

Explore how Vectra AI's approach to network detection and response provides unified visibility across IoT, OT, cloud, and identity environments — turning the network into the sensor that endpoint agents can never be.

‍